Homeland 
Security 

Daily Open Source Infrastructure Report 

19 February 2015 

Top Stories 

• A Russian national was charged February 17 in the U.S. for his alleged involvement in a 
scheme that stole more than 160 million credit card numbers resulting in hundreds of 
millions of dollars in losses to consumers and financial institutions. - Tribune Washington 
Bureau (See item 4) 

• Snow removal operations in Boston continued February 18 after a series of winter storms 
that added additional delays and cancellations to the State’s transit system. - Boston Globe 
(See item 8) 

• A state of emergency was declared in Tennessee February 16 due to deteriorating road 
conditions and major traffic issues caused by a winter storm that swept across the State. - 
Nashville Tennessean (See item 10) 

• Researchers reported that a cyber-espionage group has used spear-phishing and other 
techniques to deliver two backdoors though 100 malware samples to infect Windows PCs 
and Android devices of targets based in several countries. - Securityweek (See item 31) 




Fast Jump Menu 



PRODUCTION INDUSTRIES 

• Energy 

• Chemical 

• Nuclear Reactors. Materials, and Waste 

• Critical Manufacturing 

• Defense Industrial Base 

• Dams 

SUSTENANCE and HEALTH 

• Food and Agriculture 

• Water and Wastewater Systems 

• Healthcare and Public Health 



SERVICE INDUSTRIES 

• Financial Services 

• Transportation Systems 

• Information Technology 

• Communic ations 

• Commercial Facilities 
FEDERAL and STATE 

• Government Facilities 

• Emergency Services 



1 - 



Energy Sector 



1. February 17, Associated Press - (North Dakota) About 1,300 gallons of oil spill in 
northwest North Dakota; cleanup is underway. The North Dakota Department of 
Health reported February 17 that approximately 1,300 gallons of oil spilled in 
Cartwright when a semi-truck that was being filled with fresh water at Caliber 
Midstream Water Depot spilled residual oil through the truck’s overflow vent. Officials 
reported that cleanup was underway. 

Source: 

http://www.dailvioumal.net/view/storv/3771f00fa03a4f0a839b094acfa5fb8a/ND— Oil- 
Spill-McKenzie-County/ 

2. February 17, WVIT 30 New Britain - (Connecticut) Bristol plant fined for OSHA 
violations. The U.S. Department of Labor issued an $80,100 penalty against Covanta 
Energy Bristol, Inc., along with 16 serious safety and health workplace violations after 
an inspection at the company’s Bristol, Connecticut plant determined that workers were 
exposed to several hazards and were not properly trained and protected against 
potential threats. 

Source: http://www.nbcconnecticut.com/news/local/Bristol-Plant-Fined-for-Exposing- 
Emplovees-to-Combustible-Toxic-Materials-292213631.html 

3. February 17, Associated Press - (Georgia) More than 77,000 without power in 
Georgia after ice storm. Crews continued work February 17 to restore power to the 
remaining 77,000 customers in Georgia who lost service after an ice storm coated the 
Northeast portion of the State. 

Source: http://www.wsbtv.com/ap/ap/georgia/more-than-22500Q-without-power-in- 
georgia-after-ic/nkCgJ/ 

For another story, see item 31 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Services Sector 

4. February 18, Tribune Washington Bureau - (International) Accused Russian hacker 
to face charges in US court. A Russian national was extradited to the U.S. and 
charged February 17 in New Jersey for his alleged involvement in an international 
scheme that stole more than 160 million credit card numbers resulting in hundreds of 
millions of dollars in losses to consumers and financial institutions including Dow 
Jones, 7-Eleven, Nasdaq, Visa, and JetBlue. The suspect, arrested in the Netherlands in 
2012, allegedly hacked victims’ networks to gain access to usernames and passwords, 
credit card and personal identifiable information, and sold them to resellers around the 
world. 

Source: http://www.msn.com/en-us/news/crime/accused-russian-hacker-to-face- 
charges-in-us-court/ar-BBhHvhz 

5. February 17, Kingston Daily Freeman - (New York) Fire badly damages Key Bank 
branch in Phoenicia; vault contents, customer records OK. The Key Bank branch in 
Phoenicia, New York, issued a statement that all client information and vault contents 
were secure February 17 after a February 16 fire caused extensive damage to the 
structure. The cause of the fire remains under investigation, and the bank is closed 
indefinitely until officials can repair the damage. 

Source: http://www.dailyfreeman.com/general-news/20150217/fire-badly-damages- 
key-bank-branch-in-phoenicia-vault-contents-customer-records-ok 

6. February 17, Softpedia - (International) Vawtrak trojan downloaded via malicious 
macro for Microsoft Word. Trend Micro security researchers discovered a new cyber 
criminal campaign targeting banks including Bank of America, Barclays, Citibank, 
HSBC, Lloyd’s Bank, and J.P. Morgan with emails containing malicious macro- 
enabling Microsoft Word documents that install the Vawtrak banking trojan by 
downloading a batch file, a visual basic scripting edition (VBS script), and Powershell 
file. The malware serves clients modified pages to trick them into providing log in data 
for Microsoft Outlook, Google Chrome, Mozilla Firefox, and file transfer protocol 
(FTP) clients. 

Source: http://news.softpedia.com/news/Vawtrak-Troian-Downloaded-Via-Malicious- 
Macro-for-Microsoft-W ord-47343 8 . shtml 

7. February 16, Help Net Security - (International) Banking trojan Dyreza sends 30,000 
malicious emails in one day. Bitdefender security researchers discovered that 30,000 
malicious emails containing the banking trojan Dyreza were sent in one day to 
customers of banks including HSBC, NatWest, Barclays, RBS, Lloyds Bank, and 
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Santander from servers in the U.K., France, Turkey, Russia, and the U.S. The trojan 
allows hackers to covertly steal credentials and manipulate accounts. 

Source: http://www.net-security.org/malware news.php?id=2964 

For another story, see item 28 
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Transportation Systems Sector 

8. February 17, Boston Globe - (Massachusetts) Cancellations, delays stack up on 
commuter rail. Full-scale snow removal operations in Boston continued and a parking 
ban in the city was expected to be lifted February 18 after the latest of a series of winter 
storms dumped snow that added additional delays and cancellations to the 
Massachusetts Bay Transportation Authority’s (MBTA) transit system which already 
was already providing limited service. An MBTA representative warned that it could 
take up to 30 days to restore full service on the public transit system. 

Source: https://www.bostonglobe.com/metro/2015/02/17/mbta-commuters-face- 
hurdles-workweek-resumes/onV130TkQBpbP9tYSCGqrN/story.html 

9. February 17, Gainesville Sun - (Florida) 13 crashes snarl 1-75. Interstate 75 in 
Alachua County was closed for more than 4 hours February 17 after 13 crashes 
occurred due to slippery conditions caused by winter rains on aging roadways, leaving 
at least 7 people injured. One of the crashes caused 70 gallons of diesel fuel to spill 
onto the roadway and prompted the assistance of the Florida Department of 
Transportation and the U.S. Environmental Protection Agency to clear the scene. 
Source: 

http://www.gainesville.com/article/20150217/ARTICLES/150219671?p=l&tc=pg 

10. February 17, Nashville Tennessean - (Tennessee) Tennessee declares state of 
emergency as roads deteriorate. A state of emergency was declared in Tennessee 
February 16 due to deteriorating road conditions and major traffic issues caused by a 
winter storm that swept across the State. The Tennessee Emergency Management 
Agency activated its emergency management plan and the Tennessee National Guard 
deployed to several counties to aid with interstate crashes and perform motorist 
wellness checks. 

Source: http://www.tennessean.com/story/news/2015/02/16/tennessee-declares-state- 
emergency-roads-deteriorate/23534741/ 

11. February 17, WPXI 11 Pittsburgh - (Pennsylvania) Truck driver dies in crash that 
shutdown 1-70 in Washington Co. All westbound lanes of Interstate 70 in Washington 
County reopened after about 9 hours after a fatal crash involving 2 semi-trucks that 
blocked the roadway February 17. An unrelated crash in the same area closed one lane 
of westbound traffic later that day while HAZMAT crews cleared the scene after fuel 
began leaking from a semi-truck’s engine compartment. 

Source: http://www.wpxi.com/news/news/local/traffic-backed-miles-following-crash-i- 
70-washingt/nkCj6/ 
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For another story, see item 4 
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Food and Agriculture Sector 

12. February 17, WCNC 36 Charlotte - (North Carolina) S. Charlotte restaurant 
employee diagnosed with Hepatitis A. The Mecklenburg County Health Department 
warned patrons and staff of the Dogwood Southern Table and Bar restaurant in 
Charlotte, North Carolina, that they may be at risk for Hepatitis A after a worker was 
confirmed to have the virus. The health department advised that those who visited the 
restaurant during dinner service February 4-10, with the exception of February 6, 
should receive a vaccination. 

Source: http://www.wcnc.com/story/news/health/2015/02/16/s-charlotte-restaurant- 
employee-diagnosed-with-hepatitis-a/235 15401/ 

13. February 17, U.S. Department of Agriculture - (Indiana) Ruiz Foods recalls sausage 
product due to misbranding and an undeclared allergen. The Food Safety and 
Inspection Service announced February 17 that Ruiz Foods recalled about 59 pounds of 
its “Egg Sausage and Cheese Wrapped in a Flour Tortilla” product due to undeclared 
soy caused by misbranding. The recalled product was produced February 4 and shipped 
to a warehouse in Indiana for distribution to institutional customers. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/2015/recall-033-201 5-release 

14. February 17, U.S. Department of Agriculture - (Michigan) Michigan Brand, Inc. 
recalls products due to misbranding and an undeclared allergen. The Food Safety 
and Inspection Service (FSIS) reported February 17 that Michigan Brand, Inc., recalled 
about 4,287 pounds of pork sausage products distributed in Michigan due to undeclared 
hydrolyzed soy protein caused by misbranding. The issue was discovered during a 
routine FSIS consumer safety inspection. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/201 5/recall-032-20 1 5-release 

15. February 17, U.S. Food and Drug Administration - (National) Unilever United States, 
Inc. issues allergy alert for limited number of tubs of Breyers No Sugar Added 
Salted Caramel Swirl due to undeclared almond. The U.S. Food and Drug 
Administration announced that Unilever United States, Inc., voluntarily issued a recall 
February 16 for a limited number of 1.5-quart tubs of Breyers No Sugar Added Salted 
Caramel Swirl due to possible undeclared almonds. The products were distributed to 
retailers nationwide. 

Source: http://www.fda.gov/Safety/Recalls/ucm434540.htm 

16. February 16, Salem Capital Press - (International) Bird flu strikes second California 
poultry farm. The U.S. Department of Agriculture (USDA) confirmed February 13 the 
presence of the Eurasian H5N8 virus at an 114,000-bird chicken farm in Kings County, 
prompting Canadian authorities to issue a ban on poultry raised, processed, or shipped 
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from California. The outbreak reportedly began February 2 with an increased mortality 
among chickens, and was confirmed February 12 when the premises were also 
quarantined. 

Source: http://www.capitalpress.com/California/20150216/bird-flu-strikes-second- 
califomia-poultry-farm 
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Water and Wastewater Systems Sector 

17. February 17, West Virginia American Water Company - (West Virginia) Water 
system to restart; WVAW issues precautionary boil water advisory. West Virginia 
American Water issued a precautionary boil water advisory for approximately 2,000 
customers served by the company’s Montgomery water system while the treatment 
plant is brought back online after it was shut down as a precaution following the 
derailment of a train hauling crude oil February 16 along a tributary of the Kanawha 
River near the plant. The decision to restart the water treatment plant was made after 
three rounds of water quality testing at the water treatment plant and at various 
locations in the river showed non-detectable levels of the components of crude oil. 
Source: http://www.montgomery-herald.com/news/water-svstem-to-restart-wvaw- 
issues-precautionary-boil-water-advisory/article f9f6f756-b6d3- 1 Ie4-9bd5- 
3f8ae77c3f7b.html 

18. February 17, Maui Now - (Hawaii) Weekend storm results in 1,250 gallon Waiehu 
wastewater spill. Strong winds knocked out power and caused an equipment failure 
February 14 at the Waiehu Pump Station in Maui County resulting in the overflow of 
about 1,250 gallons of wastewater from a manhole near the pump station into a storm 
drain. Officials with the County of Maui Department of Environmental Management 
reported that the spill site was disinfected and the State Department of Health was 
notified. 

Source: http ://mauino w .com/20 1 5/02/ 1 7/weekend-storm-results-in- 1 250- gallon- 
waiehu-wastewater-spill/ 
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Healthcare and Public Health Sector 

Nothing to report 
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Government Facilities Sector 

19. February 18, Ashtabula Star Beacon - (Ohio) Subzero cold blamed for outage, delay 
of schools. Pymatuning Valley Local Schools were forced to cancel classes while four 
other school districts in Ohio had delayed openings February 17 due to cold 
temperatures that caused a circuit-breaker at a substation to knock out power for 
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customers in the Andover area. 

Source: http://www.starbeacon.com/news/local news/subzero-cold-blamed-for-outage- 
delay-of-schools/article 3c89d5a2-b715-lle4-91el-2393272e8832.html 

20. February 17, Stephenville Empire-Tribune - (Texas) Huston Academy closed 
following bomb threat. Classes were expected to resume February 18 at Huston 
Academy in Texas after a bomb threat February 17 prompted officials to close the 
school. Police cleared the scene after nothing suspicious was found. 

Source: http://www.vourstephenvilletx.com/news/local/huston-academy-closed- 
following-bomb-threat/article e466852c-b85e-585d-9f6e-cllc8ee7ddf2.html 

21. February 17, Louisville Courier- Journal - (Kentucky) JCPS, Catholic schools cancel 
Wed. classes. At least 6 school districts in Kentucky announced the cancelation of 
classes for February 18 due to a winter storm that produced snow and ice causing 
unsuitable road conditions. 

Source: http://www.courier-iournal.com/storv/news/education/2015/02/17/area- 
schools-announce-openings-closings/23560951/ 

22. February 17, Cleveland.com - (Ohio) Wickliffe schools evacuated after bomb 
threat. A nonspecific bomb threat called into the Wickliffe Police Department in Ohio 
prompted 5 schools in the city to evacuate for more than 5 hours February 17 while 
police searched the campuses and cleared the threat. 

Source: 

http://www.cleveland.com/wickliffe/index.ssf/2015/02/wickliffe schools evacuated af 
■html 

23. February 17, Pittsburgh Post-Gazette - (Pennsylvania) Winter not releasing its grip 
on region; schools announce delays, closings. Dozens of school districts in the 
Pittsburgh area were closed or had delayed openings February 17 due to subzero 
temperatures and snow. 

Source: http://www.post-gazette.com/local/region/2015/Q2/17/Pittsburgh-area-schools- 
announce-delays-closings-cold- weather-temperatures/stories/20 1502170140 

For another story, see item 31 
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Emergency Services Sector 

24. February 18, Oklahoma City Oklahoman - (Oklahoma) Inmate escapes from Custer 
County jail. Officials are searching for an inmate who escaped from the Custer County 
jail in Oklahoma by running away from the facility following church service February 
17. The inmate ran away while under the supervision of jail staff after he was assigned 
to carry a box of Bibles to a vehicle. 

Source: http://newsok.com/inmate-escapes-from-custer-county-iail/article/5394423 

25. February 18, KHQ 6 Spokane - (Idaho) Shoshone County sheriff’s deputies 
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searching for escaped inmate. Authorities are searching for a potentially armed and 
dangerous inmate who escaped from the Shoshone County Jail in Idaho February 17. 
Deputies are investigating how the inmate managed to escape from the jail. 

Source: http://www.khq.com/story/28134115/shoshone-countv-sheriffs-deputies- 
searching-for-escaped-inmate 

26. February 17, Associated Press - (Indiana) Ex-Greensburg police chief faces theft, 
misconduct counts. Police arrested a former Greensburg police chief February 17 in 
connection to stealing approximately $73,000 in cash from a police department 
property room. An Indiana State Police audit found that the cash was missing, and the 
former police chief’s husband allegedly told investigators that the suspect had a 
gambling problem and that she confessed to stealing the money in June 2013. 

Source: http://www.wlwt.com/news/Ex-Greensburg-police-chief-faces-theft- 
misconduct-counts/3 1 326502 
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Information Technology Sector 

27. February 18, Softpedia - (International) Author of Android Xbot malware includes 
curse at AV companies. Avast security researchers discovered that the Xbot Android 
malware infected over 2,570 installations in 350 unique files through third-party 
marketplaces since the beginning of February. The malware persistently runs on 
infected devices, has the capability to download content to command and control 
(C&C) servers, and primarily focuses on capturing, reading, and writing short text 
messages. 

Source: http://news.softpedia.com/news/Author-of-Android-Xbot-Malware- 
Includes-Curse-At-AV-Companies-473509.shtml 

28. February 18, Help Net Security - (International) Credit card info stolen in BigFish 
Games site compromise. BigFish Games reported that the personal and financial 
information of some of its customers that made purchases between December 24, 

2014 and January 8 may have been compromised after the company discovered 
malware installed on the billing and payment pages of their Web site January 12. 
Affected customers were notified of the breach February 11, and the company 
removed the malware and has taken steps to prevent the malware from being 
reinstalled. 

Source: http://www.net-securitv.org/secworld.php ?id=17964 

29. February 17, Softpedia - (International) Siemens fixes security flaws in Simatic 
Step 7 (TIA Portal). Siemens patched two minor and two more severe vulnerabilities 
due to glitches in Simatic Step 7 that allowed hackers to possibly learn user 
passwords, escalate privileges, or hijack and intercept industrial communication on 
TCP port 102. 

Source: http://news.softpedia.com/news/Siemens-Fixes-Security-Flaws-in-Simatic- 
Step-7 -TIA-Portal-47 341 0. shtml 
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30. February 17, Help Net Security - (International) Flaw in Netgear Wi-Fi routers 
exposes admin password, WLAN details. A network engineer discovered and 
notified Netgear support that certain versions of the brand’s WNDR3700v4, 
WNR2200, and WNR2500 home wireless routers contain a vulnerability in the 
embedded simple object access protocol (SOAP) service that could allow 
unauthenticated remote and locally-connected attackers to obtain the administrator 
password, device serial number, WLAN details, and various information related to 
clients connected to the device. 

Source: http://www.net-security.org/secworld.php?id=17959 

31. February 17, Securityweek - (International) Arabic threat group attacking 
thousands of victims globally. Kaspersky Lab security researchers reported that 
“Desert Falcons,” the first known full-scale Arabic cyber-espionage group, has used 
spear-phishing and social engineering techniques to deliver two backdoors though 
100 malware samples to infect Windows PCs and Android devices of targets based in 
Egypt, Palestine, Israel, Jordan, the U.S., and other countries for at least 2 years. The 
malware has full-backdoor capability as well as the capability to steal call and SMS 
logs in Android versions, and attackers have targeted victims from political, military, 
government individuals and organizations, media outlets, energy and utility providers, 
physical security companies, and others holding geopolitical information. 

Source: http://www.securityweek.com/arabic-threat-group-attacking-thousands- 
victims-globally 

For additional stories, see items 4, 6, and 7 

Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

32. February 17, Fierce Wireless - (National) T-Mobile recovers from service 

disruptions in the Northeast. T-Mobile service in the Northeast region of the U.S. 
was restored after several hours February 13 following a network disruption that 
resulted in intermittent service, loss of high-speed data reception, and the ability to 
make voice calls. The cause of the outage was not disclosed. 

Source: http://www.fiercewireless.com/story/t-mobile-recovers-service-disruptions- 
northeast/20 1 5 -02- 1 7 



For another story, see item 31 
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Commercial Facilities Sector 



33. February 18, KNBC 4 Los Angeles - (California) Possible honey oil lab spawns apt. 
fire, evacuations. About 150 residents from approximately 12 buildings at an 
apartment complex in Rosemead were evacuated February 17 while authorities 
investigated a fire that was initially believed to be sparked by a pipe bomb but later 
determined to be connected to a possible honey oil lab. Evacuations were lifted more 
than 3 hours after they were ordered, while the incident remained under investigation. 
Source: http://www.nbclosangeles.com/news/local/Rosemead-Apartments-Evacuated- 
After-Disco verv-of-Possible-Pipe-Bomb-29230203 1 .html 

34. February 18, Frederick News-Post - (Maryland) Hazmat teams respond after 
chemical mix sickens 3 in building. HAZMAT crews responded February 17 to the 
Wormans Mill Clubhouse in Frederick to contain a chemical reaction caused by 
cleaning products that reportedly sickened 3 staff members. The clubhouse was cleared 
to reopen several hours later after crews cleaned the chemical residue. 

Source: http://www.fredericknewspost.eom/z/eontent type/news article/hazmat-teams- 
respond-after-chemical-mix-sickens-in-building/article 781d2630-0db5-5c49-9ffl- 
3656141ff8el.html 



35. February 18, Southgate News-Herald - (Michigan) Fire at Taylor apartment 

complex affects 20 units; all evacuated safely. Twenty units at The Ponds Apartments 
complex in Taylor were affected by a February 16 fire that remains under investigation. 
Source: 

http://www.thenewsherald.com/articles/2015/02/18/news/doc54e2bb8ab636594999272 

8.txt 



36. February 17, WABC 7 New York City - (New York) Water service being restored at 
East Harlem housing complex after leak. Water service was expected to be restored 
February 17 to residents in 244 units of 2 buildings at the Wagner Houses housing 
complex in East Harlem after service was disrupted February 16 due to a leaking pipe 
that may have been caused by the cold. The New York City Housing Authority 
provided a water tower and bottled water to impacted residents during the outage. 
Source: http://7online.com/news/water-leaks-at-east-harlem-housing-complex-lower- 
manhattan-ho tel/5 19626/ 



37. February 16, WNBC 4 New York City - (New York) 600 guests forced from rooms 
after water pipe bursts at NYC hotel: FDNY. More than 600 guests at a Holiday Inn 
in New York City were evacuated February 16 after a sprinkler pipe on the 50-story 
building’s roof burst and caused water to flow through the elevator shafts. Displaced 
guests were relocated to habitable rooms left inside the hotel or transported to nearby 
hotels while crews worked to stop the leak and make repairs. 

Source: http://www.nbcnewvork.com/news/local/Holiday-Inn-Financial-District-Burst- 
Tank-Water-New-York-292064981.html 



For another story, see item 4 
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Dams Sector 



38. February 16, Associated Press; Dallas Morning News - (Texas) North Texas 

Municipal Water District to dredge reservoir. Leaders of the North Texas Municipal 
Water District, that serves about 1.6 million customers near Dallas, issued approval for 
dredging to begin in 2 areas of Lavon Lake to help increase water deliveries by 7.2 
million gallons daily. A water district spokeswoman announced that 5 years of drought 
has affected Texas and exposed broad swaths of dry sand along the edges of Lavon, 
and the $1.9 million project will remove 10 feet of accumulated slit around the 2 of 3 
intake pipes. 

Source: http://www.washingtontimes.com/news/2015/feb/16/north-texas-municipal- 
water-district-to-dredge-res/ 
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